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DETAILED ACTION 



I. 



Claims 17-21 were cancelled in a preliminary amendment. 



II. 



Claim 6 has been cancelled. 



III. 



Claims 1-5, 7-16 and 22-24 have been examined. 



IV. Responses to Applicant's remarks have been given. 



Response to Arguments 



1 . Applicant's arguments, see page 6, filed 1 0/20/1 0, with respect to 35 U.S.C. 1 1 2, 
second paragraph rejection of claim 5 have been fully considered and are persuasive. 
The 35 U.S.C. 112, second paragraph rejection of claim 5 has been withdrawn. 

2. The objection to claims 1 and 22-24 has been withdrawn due to Applicant's 
amendment to said claims. 

3. In response to Applicant's argument that the references fail to show certain 
features of applicant's invention, it is noted that the features upon which applicant relies 
(i.e., on page 7 of the Applicant's remarks, "The presently claimed invention is directed 
to a substantially automated method of removing covert threats hidden or concealed in 
a document, not by visually/manually analyzing the documents to identify those threats, 
but rather by applying predetermined automated transformations to the documents 
thereby to mitigate the effect of such threats without identification of the specific threats 
and without requiring intervention by a human operator) are not recited in the rejected 
claim(s). Although the claims are interpreted in light of the specification, limitations from 
the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1 181 , 26 
USPQ2d 1057 (Fed. Cir. 1993). 
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4. Further, dependent claims 3 and 10 convey liuman interaction (i.e., claim 3: 
"which the second document is digitally signed by a sanctioning user" and claim 10: "in 
which the review and sanction comprises sanction by a human user"); thus a human 
component is part of the Applicant's claimed invention. 

5. Regardless, according to MPEP 2144.04, "The court held that broadly providing 
an automatic or mechanical means to replace a manual activity which accomplished the 
same result is not sufficient to distinguish over the prior art."; In re Venner, 262 F.2d 91 , 
95, 120 USPQ 193, 194 (CCPA 1958). 

6. Regarding the Applicant's argument that the claimed "security threats" pertain to 
"malicious code" and that Patton is silent in disclosing this; the Examiner upholds that 
the independent claims - though claiming "security threats" - do not state that said 
"security threats" pertain to "malicious code". Dependent claims 1 1 and 12 are directed 
towards "malicious code" and the prior art reference Walsh was utilized in disclosing 
said "malicious code" via Figure 2, elements 204 and 208, Figure 3, elements 302 and 
304 and column 9, lines 24-33, "Once the computer is infected with the macro virus, 
each computer file that you save is automatically infected with the macro virus". 

7. Also, the Applicant argues that Patton "positively teaches away both from the 
specifically claimed material and from one underlying goal, namely to provide an 
automated means of mitigating the risk from covert threats. Those covert threats may 
relate to leakage of (maliciously) concealed confidential information, or transmission of 
computer viruses, etc. - concealed within electronic documents whereby to minimize 
human intervention which would othenwise cause an undesirable bottle-neck in such 
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systems". The Examiner reiterates that the automation is not explicitly stated within the 
claim language, nor is it a novel component. Further, Patton was not utilized to 
disclose the claimed "malicious code". 

8. Regarding the Applicant's argument that "Whilst Simard might arguably add 
entropy and or randomness, etc. to an image, it does not do so In any context of 
automatedly mitigating covert threats embedded within the image whilst substantially 
maintaining the visible image whereby to minimize human involvement"; the Examiner 
upholds that the automated means are not explicitly stated within the claim language 
and that Simard does disclose "at least one of entropy and randomness" as claimed by 
the Applicant via the cited grounds below. 

9. With regards to the Applicant's argument pertaining to claim 4, the Examiner 
upholds that Patton discloses the feature within said claim via page 3, paragraph 31 and 
page 4, paragraph 40, "while authorized internal engineers 120 can have access to all 
global export DPs 1 18 on web site 124, the global engineers 122 are preferably limited 
to being able to access only global export issued DPs 1 18 that have been designated or 
assigned to the authorized global engineer 1 22 on web site 1 24". 

1 0. With regards to the Applicant's arguments pertaining to the "transformation" step 
within claim 5, the Examiner upholds that Patton discloses this feature via, but not 
limited to, page 4, paragraph 39, "issued DP 1 14 is preferably converted Into a HTML 
format or a read-only, portable file format, e.g. PDF". Though the format of the 
document has changed, the document is still able to be read by the user within Patton 
(i.e., page 5, paragraph 47, "the author 102 can also perform character or text searches. 
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which are described in steps 318-320, on the 'sanitized' draft DP 1 10 in its portable or 
read-only format, e.g. in its PDF format, rather than on the draft DP 108 in its word 
processing format, e.g. in its Word format"). 

1 1 . With regards to claim 1 5, combining the references of Patton and Williams would 
not take away from the teachings of Patton since it would be obvious to provide a 
means to scrub documents prior to transport - regardless of the domain (higher or 
lower) sending/receiving the scrubbed document - in order to provide security against 
an external source from unduly altering or obtaining access to the restricted content of 
the document(s). 

Claim Objections 

1 2. Claim 7 is objected to because of the following informalities: dependency upon 
cancelled claim (claim 6). Appropriate correction is required. 

Claim Rejections - 35 USC §112 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification sliall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

1 3. Claims 1 5 and 1 6 are rejected under 35 U.S.C. 1 1 2, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
applicant regards as the invention. The Applicant added the claim language of "wherein 
a security domain comprises a network having a common level of resilience to security 
threats" to claim 1; however, dependent claims 15 and 16 indicate that the security 
domains are of different levels. It is unclear as to how the domains can have "a 
common level" and yet also be of different levels. 
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Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1 , 148 

USPQ 459 (1966), that are applied for establishing a background for determining 

obviousness under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the phor art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 

Claims 1, 2, 4-10, 14, 16 and 22-24 are rejected under 35 U.S.C. 103(a) as being 

unpatentable over United States Patent Application Publication No. US 2003/0145017 

to Patton et al., hereinafter Patton and further in view of United States Patent No. United 

States Patent No. 7,624,277 to Simard et al., hereinafter Simard. 

14. Regarding claims 1 , 22, 23 and 24, Patton teaches a method, an apparatus, a 

computer chipset and a computer readable medium having program code record 

thereon for communicating an electronic document between security domains, wherein 

a security domain comprises a network having a common level of resilience to security 

threats , the method comprising the steps of: 

receiving, in a first security domain (page 3, paragraph 29, "internal source" and "United 
States"), a request to transmit to a second security domain (page 3, paragraph 29, 



Application/Control Number: 1 0/591 ,205 Page 7 

Art Unit: 2431 

"external sources" and "out of the United States or to foreign persons, whether in the 
United States or abroad") a first electronic document in a first data format capable of 
supporting one or more covert security threats (page 3, paragraph 29); 

creating a second document in a second data format incapable of supporting the 
one or more security threats, responsive to the content of the first document (page 3, 
paragraph 30, "remove restricted information, technical data and proprietary information 
from a master document" and paragraph 32, page 4, paragraph 37, "the draft DP 108 is 
in a word processing file format such as Microsoft Word, Corel WordPerfect or any other 
suitable word processing format. The draft DP 108 can be converted using the 
sanitization application and the process described in greater detail below, to a 
'sanitized' draft DP 1 10 and a 'sanitized' draft DP log 112." and paragraph 39, "issued 
DP 1 14 is preferably converted into a HTML format or a read-only, portable file format, 
e.g. PDF" and page 5, paragraph 47, "the author 102 can also perform character or text 
searches, which are described in steps 318-320, on the 'sanitized' draft DP 1 10 in its 
portable or read-only format, e.g. in its PDF format, rather than on the draft DP 108 in its 
word processing format, e.g. in its Word format"); 

forwarding the second document in place of the first document to the second 
security domain (page 3, paragraph 31 , "After making a determination to provide 
specific content included within the log file to an external or global source and taking 
some additional steps to ensure that appropriate security and authorization procedures 
have been followed, the specific content included within the log file can be transferred to 
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the external or global source following the more restrictive U.S. Government export 
control license or company or organizational legal arrangements"). 

1 5. Patton teaches the claimed invention, as cited above. However, Patton does not 
teach the claim language pertaining to "wherein creating said second document 
comprises adding at least one of entropy and randomness to at least one characteristic 
of the representation of the first document". Simard teaches said claim language, as 
cited below. 

1 6. Regarding claims 1 , 22, 23 and 24, Simard teaches wherein creating said second 
document comprises adding at least one of entropy and randomness to at least one 
characteristic of the representation of the first document (column 6, lines 3-1 1 , 
"generate a random character string image" and column 7, lines 36-52, "generates each 
image using a random set of characters"). 

1 7. The motivation to combine to prevent "a script from successfully running a 
repetitive task that is supposed to be performed by a human" {Simard- column 3, lines 
5-7). 

1 8. Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to incorporate the teachings of Simard with the teachings 
of Patton to provide a methodology that "yields significant reductions in spam, software 
piracy, and operating costs and yields significant improvements in security" {Simard - 
column 3, lines 18-20). 

1 9. Regarding claim 2, Patton teaches in which forwarding of the second document 
is conditional upon user sanction (page 4, paragraph 39, "Once the draft DP 108, the 
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sanitized draft DP 1 10 and the sanitized draft DP log 1 12 have been approved by 
approvers 106, the draft DP 108 is then converted into an issued DP 1 14 that operates 
as a master document, a global export issued DP log 1 16 and a global export issued 
DP 118."). 

20. Regarding claim 4, Patton teaches in which the second document is forwarded to 
the second security domain via at least one data diode (page 3, paragraph 31 and page 
4, paragraph 40). 

21 . Regarding claim 5, Patton teaches in which the step of creating the second 
document comprises performing a transformation to the first document which modifies 
the underlying data format of the document whilst preserving the visible informational 
content (page 4, paragraph 39, "issued DP 114 is preferably converted into a HTML 
format or a read-only, portable file format, e.g. PDF" and page 5, paragraph 47, "the 
author 102 can also perform character or text searches, which are described in steps 
318-320, on the 'sanitized' draft DP 110 in its portable or read-only format, e.g. in its 
PDF format, rather than on the draft DP 108 in its word processing format, e.g. in its 
Word format"). 

22. Regarding claim 7, Patton teaches in which the at least one characteristic 
comprises at least one of colour and spacing (page 6, paragraph 52, "the collapsing of 
any spaces" and paragraph 55 and page 7, remainder of paragraph 57). 

23. Patton teaches the claimed invention, as cited above. However, Patton does not 
teach the claim language pertaining to "in which the step of creating the second 
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document comprises applying a lossy compression method". Simard teaches said 
claim language, as cited below. 

24. Regarding claim 8, Simard teaches in which the step of creating the second 
document comprises applying a lossy compression method (column 12, lines 29-34). 

25. The motivation to combine would be "because the lossy compression yields even 
smaller images and additional security" {Simard- column 12, lines 31-34). 

26. Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to incorporate the teachings of Simard with the teachings 
of Patton to render the data in a manner "that a human can easily read but that is hard 
for a computer to read" {Simard- column 12, lines 45-57). 

27. Regarding claim 9, Patton teaches comprising the step of: conveying the second 
document to a user sanction function for review and sanction prior to sending the 
second document to the second security domain (page 3, paragraph 31 , "The log file 
can be viewed by authorized internal users to confirm what information has been 
removed from the document or to determine if specific contents of the log file can be 
provided to an external source under more restrictive export control licenses or 
appropriate legal arrangements."). 

28. Regarding claim 10, Patton teaches in which review and sanction comprises 
sanction by a human user (page 3, paragraph 35, "In other words, the sanitization 
application can be downloaded to the authorized user's computer from another 
computer over a network connection or an Internet connection and can then be 
operated without the network connection. The user is able to use the sanitization 
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application without a network connection and is able to store the master documents, 
sanitized documents, document log files and related information and documents in a 
database." and page 4, remainder of paragraph 35 and paragraph 39, "The draft DP 
108, the sanitized draft DP 1 10 and the sanitized DP log 1 12 can be reviewed by 
reviewers 104, which can include author 102, and then approved by approvers 106, 
which can include author 102 and reviewers 104). 

29. Regarding claim 14, Patton teaches in which the first security domain and 
second security domain are rated at different security levels (page 3, paragraphs 29-31 , 
"the master document, when viewed by internal or company users, is identical to the 
original or master document, except that the information designated for removal from 
the original or master document is distinguished from the remaining text and/or 
graphics. In contrast, when viewed by an external or global source, the sanitized 
document does not include any information designated for removal from the original or 
master document"). 

30. Regarding claim 1 6, Patton teaches in which the first security domain is a higher- 
level security domain than the second security domain (page 3, paragraph 29, "internal 
source" and "United States", "external sources" and "out of the United States or to 
foreign persons, whether in the United States or abroad" and paragraph 31). 

[Wherein the claimed "first security domain" is interpreted by the Examiner 
to pertain to Patton's disclosure of an "internal source" and "the United 
States" with regards to certain information not being able to be sent 
outside of the United States. The claimed "second security domain" 
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pertains to Patton's disclosure of "external sources" and to areas "out of 
the United States". ] 

Claim Rejections - 35 USC § 103 
The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary sl<ill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1 , 148 
USPQ 459 (1966), that are applied for establishing a background for determining 
obviousness under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 

31 . Claim 3 is rejected under 35 U.S.C. 1 03(a) as being unpatentable over Patton as 
applied to claim 1 above, and further in view of United States Patent No. 5,787,175 to 
Carter, hereinafter Carter. 

32. Patton and Simard teach the claimed invention, as cited above. However, Patton 
and Simard do not teach the claim language within claim 3 pertaining to "in which the 
second document is digitally signed by a sanctioning user". Carter teaches said claim 
language, as cited below. 

33. Regarding claim 3, Carter teaches in which the second document is digitally 
signed by a sanctioning user (column 17, lines 28-47, "Collaborative signatures control 
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the attribution of a given version of the work group document 90 to one or more 
members of the collaborative group"). 

34. The motivation to combine would be "to provide such a method and apparatus 
which limit access to work group documents to those people who are expected to 
contribute directly to the document" {Carter - column 5, lines 25-28). 

35. Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to incorporate the teachings of Carter with the teachings of 
Patton and Simard "to provide such a method and apparatus which permit any given 
member of the work group to independently change the cryptographic method used for 
key generation in order to foil unauthorized decryption attempts, without preventing 
authorized access to the document" {Carter- column 5, lines 62-67). 

36. Claims 11-13 are rejected under 35 U.S.C. 1 03(a) as being unpatentable over 
Patton and Simard, as applied to claim 1 above, and further in view of United States 
Patent No. 5,956,481 to Walsh et al., hereinafter Walsh. 

37. Patton and Simard teach the claimed invention, as cited above. However, Patton 
and Simard do not teach the claim language pertaining to the presence of "malicious 
code". Walsh teaches said language, as cited below. The same motivation and 
obviousness to combine will pertain to each of claims 11,12 and 1 3. 

38. Regarding claim 1 1 , Walsh teaches in which the one or more security threats 
comprise presence in the first document of malicious code (Figure 2, elements 204 and 
208, Figure 3, elements 302 and 304, Figure 4C and Figure 5B, column 7, lines 3-10, 
column 9, lines 13-52, "Once the computer is infected with the macro virus, each 
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computer file that you save is automatically infected with the macro virus" and "A macro 
virus uses the macro programming language of an executable program to distribute the 
macro virus to data files on a computer system"). 

39. Regarding claim 1 2, Walsh teaches in which the malicious code comprises at 
least one of a computer virus and a Trojan horse (Figure 2, elements 204 and 208, 
Figure 3, elements 302 and 304, Figure 4C and Figure 5B, column 7, lines 3-10, column 
9, lines 1 3-52, "Once the computer is infected with the macro virus, each computer file 
that you save is automatically infected with the macro virus" and "A macro virus uses 
the macro programming language of an executable program to distribute the macro 
virus to data files on a computer system", column 1 0, lines 7-34, column 1 1 , lines 1 6-28, 
column 12, lines 26-37 and 53-65). 

40. Regarding claim 1 3, Walsh teaches in which the one or more security threats 
comprises data steganographically concealed within the first document (column 2, lines 
4-6, "macro virus could attack a document by inserting a copy of itself into the data file" 
and column 9, lines 13-52, "Once the computer is infected with the macro virus, each 
computer file that you save is automatically infected with the macro virus" and "A macro 
virus uses the macro programming language of an executable program to distribute the 
macro virus to data files on a computer system"). 

41 . The motivation to combine would be to provide "a system for protecting a 
computer from infection by a virus that attacks data files of an executable program" 
{Walsh - column 2, lines 62-64). 
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42. Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to incorporate the teachings of Walsh with the teachings of 
Patton and Simard in order to "protect against an unauthorized loading of a virus 
component, such as macro code, that can result in damage to data file content and to 
computer storage" (Walsh - column 2, lines 65-67 and column 3, lines 1-4). 

43. Claim 15 is rejected under 35 U.S.C. 103(a) as being unpatentable over Patton 
and Simard as applied to claim 1 above, and further in view of United States Patent No. 
6,304,973 to Williams, hereinafter Williams. 

44. Patton and Simard teach the claimed invention, as cited above. However, Patton 
and Simard do not teach the claim language pertaining to "the first security domain is a 
lower-level security domain than the second security domain". Williams teaches said 
claim language, as cited below. 

45. Regarding claim 1 5, Williams teaches in which the first security domain is a 
lower-level security domain than the second security domain (Figure 6, column 13, lines 
10-21, "a Multi-Level Secure computer that is capable of simultaneously processing a 
range of Secret to Top Secret" and lines 25-37 and column 14, lines 7-9). 

46. The motivation to combine would be "to provide a security device that prevents 
unauthorized third parties from gaining access to a host. It is another object of the 
invention to provide a multi-level secure network having a security device coupled 
between each host and the network medium" (l/W/Z/ams- column 4, lines 31-35). 

47. Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to incorporate the teachings of Williams with the teachings 
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of Patton and Simard so that the "network prevents unauthorized users from gaining 
access to sensitive information" {Williams - column 4, lines 41 and 42). 

Conclusion 

48. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 

§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

49. A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

50. The prior art made of record and not relied upon is considered pertinent to 

applicant's disclosure. 

51 . The following United States Patents are cited to further show the state of the art 
with respect to secure distribution of messages within a network environment: 

United States Patent No. 7,130,885 to Chandra et al., which is cited to show 
methods and apparatus providing electronic messages that are linked and aggregated. 
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United States Patent No. 6,216,231 to Stubblebine, which is cited to show 
specifying security protocols and policy constraints in distributed systems. 

United States Patent No. 7,216,043 to Ransom et al., which is cited to show a 
push communications architecture for intelligent electronic devices. 

52. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to JEREMIAH AVERY whose telephone number is 
(571)272-8627. The examiner can normally be reached on Monday thru Friday 8:30am- 
5pm. 

53. If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, William Korzuch can be reached on (571) 272-7589. The fax phone number 
for the organization where this application or proceeding is assigned is 571 -273-8300. 

54. Information regarding the status of an application may be obtained from the 
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